2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos
Size 2.2MB
Sample261003-whreesvt6r
SHA256 26291847e6f073c0ed614ce68a8d3f58284306e0a6c2d5b8994bf4a453fa47fc
MD5 07988da917f78aa494d68f1d87c71b78
SHA1 8017f5b9177c7082903eb0f06d38f4414c6852e8
SHA512 75662cb31bf5c2f04630f71e8b0457df626e9d34cb2a7e6ab68baf1d58d179459d4fba12e115d141a62bd9ce4e26b446b622f1f39ea50684aa7291ad110da1b3
SSDEEP 49152:kSy74I4qtZp9wlhcb9BO+Z/dGLMuLZHQ1EsO:s4Gp9w8O+Jb1W
TLSH
T18AB55BA3A52B8131D673483054776E168F6F3D290BB108E36189BE1F057AAD36B3F617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

.exe 2.2MB

2026-10-02_07988da917f78aa494d68f1d87c71b78_adposhel_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 7f1a32dd2fcc0202264fe3f9d8ecaa71
SHA256 26291847e6f073c0ed614ce68a8d3f58284306e0a6c2d5b8994bf4a453fa47fc
MD5 07988da917f78aa494d68f1d87c71b78
SHA1 8017f5b9177c7082903eb0f06d38f4414c6852e8
SHA512 75662cb31bf5c2f04630f71e8b0457df626e9d34cb2a7e6ab68baf1d58d179459d4fba12e115d141a62bd9ce4e26b446b622f1f39ea50684aa7291ad110da1b3
SSDEEP 49152:kSy74I4qtZp9wlhcb9BO+Z/dGLMuLZHQ1EsO:s4Gp9w8O+Jb1W
TLSH
T18AB55BA3A52B8131D673483054776E168F6F3D290BB108E36189BE1F057AAD36B3F617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

131019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\.jenkins\workspace\group_traffic\duplicate_file\client\client\out\Release\duplicate_file_clean_tray.pdb

kernel32

LoadLibraryExW GetLocalTime GetStartupInfoW CreateProcessW CreateEventW SetEvent IsBadReadPtr GetModuleHandleW VirtualProtect GetCurrentProcessId GetCurrentProcess WaitForSingleObject SetUnhandledExceptionFilter CloseHandle lstrcpynW WideCharToMultiByte FindResourceW SizeofResource LockResource LoadResource FreeLibrary FindResourceExW GetTickCount64 GetCurrentThreadId LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError GetCommandLineW LoadLibraryW GetProcAddress MultiByteToWideChar GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW WriteConsoleW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitThread GetStdHandle GetModuleHandleExW GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetFileAttributesExW RtlUnwind CreateTimerQueue UnregisterWaitEx HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError QueryDepthSList InterlockedFlushSList DuplicateHandle RaiseException DecodePointer GetStringTypeW FormatMessageW QueryPerformanceCounter TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA ReleaseMutex CreateMutexW LocalFree UnhandledExceptionFilter TerminateProcess DeleteFileW CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile CreateFileW GetFileSizeEx ReadFile SetFilePointer GetFileSize WriteFile FlushFileBuffers FreeResource ExitProcess GetACP GlobalAlloc GlobalLock GlobalUnlock lstrcmpW MulDiv GetVersion GlobalFree InterlockedExchange InterlockedCompareExchange ResumeThread Sleep ResetEvent InterlockedIncrement InterlockedDecrement SetEndOfFile GetTempPathW GetTempFileNameW MapViewOfFileEx lstrcmpiW CopyFileW ReleaseSemaphore FindClose FindNextFileW DeviceIoControl lstrcmpA lstrcmpiA GetSystemDirectoryW CreateFileA GetSystemWindowsDirectoryW GetVersionExW WaitForSingleObjectEx SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA

user32

wsprintfW IsChild UpdateLayeredWindow IsWindowVisible SetFocus GetFocus GetKeyState SetCapture ReleaseCapture BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect ScreenToClient MapWindowPoints IsRectEmpty GetParent GetClassNameW GetWindow RegisterClassW ShowWindow EnableWindow UnregisterClassW SetPropW GetPropW AdjustWindowRectEx IsIconic IsZoomed SetWindowRgn MessageBoxW GetMonitorInfoW wvsprintfW SetCursor GetMessageW OffsetRect CharNextW CopyRect IntersectRect CharPrevW DrawTextW SetRect DestroyIcon DrawIconEx GetIconInfo CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor RemovePropW GetWindowDC SetWindowTextW GetWindowTextW GetWindowTextLengthW MoveWindow CreateAcceleratorTableW InvalidateRgn FillRect FindWindowExW RegisterClassExW GetClassInfoExW PostMessageW CreateWindowExW IsWindow SetWindowLongW LoadCursorW DefWindowProcW CallWindowProcW DestroyWindow GetCursorPos SetTimer KillTimer GetDC ReleaseDC RegisterWindowMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageTimeoutW SendNotifyMessageW PostQuitMessage SendMessageW SystemParametersInfoW GetWindowLongW SetWindowPos BringWindowToTop InflateRect PtInRect SetRectEmpty GetWindowRect SetForegroundWindow GetMenu GetDesktopWindow MonitorFromWindow LoadImageW LoadIconW UpdateWindow

gdi32

MoveToEx TextOutW GetDIBits GetClipBox GetCharABCWidthsW CreateRectRgnIndirect SetDIBitsToDevice GetDeviceCaps ExtTextOutW CreateSolidBrush CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn CombineRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW SelectObject SaveDC RestoreDC Rectangle GetTextExtentPoint32W GetStockObject DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectClipRgn RoundRect LineTo CreateDCW

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegGetValueW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA OpenProcessToken GetTokenInformation RegCloseKey RegQueryValueExW

shell32

SHCreateDirectoryExW Shell_NotifyIconW ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc OleLockRunning CLSIDFromProgID CLSIDFromString CoCreateInstance CreateStreamOnHGlobal CoCreateGuid CoInitialize CoUninitialize

oleaut32

SysFreeString VarUI4FromStr SysAllocString SysAllocStringLen SafeArrayCreate VariantClear VariantInit SafeArrayPutElement

shlwapi

PathCombineW PathFindFileNameW StrStrIA StrStrIW SHGetValueA SHSetValueA StrCmpNIW StrTrimA StrCmpIW PathRemoveFileSpecW SHGetValueW PathAppendW PathFileExistsW PathIsDirectoryW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

gdiplus

GdipGetImageGraphicsContext GdipDrawImageRectI GdipGetPropertyItem GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipCreateFromHDC GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDrawEllipseI GdipDrawPath GdipDeletePen GdipCreatePen1 GdipAddPathArc GdipGetImageEncoders GdipGetImageEncodersSize GdipDeleteGraphics GdipSetSmoothingMode GdipFillEllipseI GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArcI GdipCreateTexture GdipSaveImageToFile GdipLoadImageFromStreamICM GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipDrawImageRectRectI

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

wininet

InternetGetConnectedState InternetGetCookieExW InternetCrackUrlW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

msimg32

GradientFill AlphaBlend

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

generic

count=1, id=208, version=65501,

count=32, id=241, version=40116,

count=177, id=243, version=40116,

count=37, id=242, version=40116,

count=1, id=209, version=65501,

count=2, id=264, version=27051,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=63, id=261, version=27031,

count=6, id=261, version=27032,

count=2, id=199, version=41118,

count=25, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=14, id=206, version=65501,

count=37, id=203, version=65501,

count=512, id=1, productName=Unmarked objects,

count=39, id=261, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,